Proper Device Naming In Asterisk
In Asterisk, the concept of an extension number being tied to a specific device does not exist. Asterisk is aware of devices it can call or receive calls from, and how you define in your dialplan how to reach those devices is up to you. Because it has become common practice to think of a specific device as having an extension number associated with it, it only becomes natural to think about naming your devices the same as the extension number you're providing it. But by doing this, you're limiting the powerful concept of separating user from extensions, and extensions from devices. It can also be a security hazard to name your devices (for example a VoIP Phone) with a number, as this can open you up to brute force attacks. Many of the current exploits deal with device configurations which utilize a number, and even worse, a password that matches the devices name in your VoIP software configuration. For example, take a look at this poorly created device in sip.conf: [1000] type=friend context=international_dialing secret=1000 As implied by the context, we've permitted a device named 1000 with a password of 1000 to place calls internationally. If your PBX phone system is accessible via the internet, then your system will be vulnerable to expensive international calls. Even if your system is not accessible via the internet, people within your organization could get access to dialing rules you'd prefer to reserve only for certain people. A more secure example for the device would be to use something like the MAC address of the device, along with a strong password (see the section Secure Passwords). The following example would be more secure: [0004f2040001] type=friend context=international_dialing secret=aE3%B8*$jk^G Then in your dialplan, you would reference the device via the MAC address of the device (or if using the softphone, a MAC address of a network interface on the computer). Also note that you should NOT use this password, as it will likely be one of the first ones added to the dictionary for brute force attacks.